How can I find the data retention and indexers involved?

[danielbb]

I need a query that will provide the earliest date for data within an index as well as the indexer it is stored on, specifically looking for which indexes are storing data for one year or more and on which indexers they are being stored on.

Any ideas?

[SinghK]

Data retention can also be checked from indexes.conf thuogh you will have to convert time.

[isoutamo]

That told what has defined, but it didn't told you what is current situation on your environment. There could be e.g. too less space for fulfil those definitions and/or some events could be there much longer as buckets contains newer events etc.

Here is some older post which explain this behabiour

• https://community.splunk.com/t5/Getting-Data-In/What-counts-for-Splunk-retention-time-if-events-come...
• https://community.splunk.com/t5/Splunk-Enterprise/Why-is-the-age-of-the-data-larger-than-the/m-p/548...
• https://community.splunk.com/t5/Splunk-Search/Why-am-I-still-seeing-old-data/m-p/605516
• https://community.splunk.com/t5/Deployment-Architecture/Hot-Warm-Cold-bucket-sizing-How-do-I-set-up-...

[isoutamo]

Hi

You probably have MC installed, configured and in use in your environment? If not then you should take it into use!

You can see (almost) this from MC -> Indexing -> Indexes and Volumes: Deployment.

If that report is not exactly what you are looking for you could open it's search (by right hand side lower corner) and update that search to fulfil your needs.

r. Ismo